feat(plugin-kit): scaffold @punktfunk/plugin-kit + phase-0 spikes

Two spikes validating the riskiest seams of the plugin-kit design before
implementation:

- HttpApi (effect/unstable/httpapi) served on Bun behind the SDK's
  servePluginUi using ONLY effect-core layers (Etag.layerWeak, Path.layer,
  HttpPlatform.layer + FileSystem.layerNoop) — no platform package. Auth,
  schema validation, and static fallthrough all verified end-to-end.
- Browser client prefix strategy for the console proxy: both
  transformClient+prependUrl AND baseUrl preserve the /plugin-ui/<id>
  path prefix. Nested Schema.withDecodingDefaultKey defaults confirmed
  (Effect-valued defaults; encodingStrategy "omit" restores raw shape
  on encode).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

plugin-kit/bunfig.toml

@@ -0,0 +1,5 @@
+# Resolve the `@punktfunk` scope from the Gitea npm registry. During local development the
+# SDK is consumed via the `link:../sdk` devDependency; this matters once the kit is depended
+# on from outside the repo.
+[install.scopes]
+"@punktfunk" = "https://git.unom.io/api/packages/unom/npm/"